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We develop a general framework for reasoning about distances between transition systems with quan- 
titative information. Taking as starting point an arbitrary distance on system traces, we show how 
this leads to natural definitions of a linear and a branching distance on states of such a transition 
system. We show that our framework generalizes and unifies a large variety of previously considered 
system distances, and we develop some general properties of our distances. We also show that if the 
trace distance admits a recursive characterization, then the corresponding branching distance can be 
obtained as a least fixed point to a similar recursive characterization. The central tool in our work is 
a theory of infinite path-building games with quantitative objectives. 



1 Introduction 

In verification of concuirent and reactive systems, one generally seeks to assert properties of systems 
expressed in terms of sets of traces (or languages) or in terms of computation trees. The language 
point of view leads to what is generally called linear semantics, whereas the tree point of view leads to 
branching semantics. These semantics are the extreme points in a spectrum containing a number of other 
useful notions; see [.16,1 for an overview. 

As emphasized in EOll . working with applications in complex reactive systems or in embedded sys- 
tems means that classical notions of linear and branching equivalence (or inclusion) of processes often 
need to be extended to accommodate quantitative information. This can be in relation to real-time be- 
havior, resource usage, or can be probabilistic or stochastic information. In such a quantitative setting, 
equivalences and inclusions are replaced by symmetric or asymmetric distances between systems. 

This approach of quantitative analysis has been taken in numerous papers by multiple authors, both 
in the real-time (or hybrid), in the probabilistic, and in general quantitative settings, see ll2l[3l[8l- [T2l[T5l 
[T9l|2Tl|22l|27J for a (non-exhaustive) choice of references. Indeed, the quantitative approach is also 
useful in settings without quantitative information in the models, e.g. in fSJ various distances related to 
implementation correctness of discrete systems are considered. 

The above-mentioned dichotomy between languages and trees persists in the quantitative setting, 
where one hence encounters both notions of linear and of branching distances. To the best of our 
knowledge, the treatment of those distances, and of the relations between them, has so far been somewhat 
ad hoc. Indeed, the general approach appears to be to introduce some particular distances which are 
relevant for a particular application and then show some useful properties; in this paper, we try to unify 
and generalize some of these approaches. 
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The present paper is in a sense a follow-up to previous papers lfT2l|27]| by the same authors. In 
those papers, we introduce and investigate three different linear and branching distances. A paper similar 
in spirit to these is [2J, which analyses properties of what we later will call the point-wise distance for 
weighted Kripke structures. The starting point for the present paper is then the observation of similarities 
between the constructions for different types of distances, which we here generalize to encompass all of 
them and to construct a coherent framework. 

In this paper, we take the view that in practical applications, say in reactive systems, the system dis- 
tance which measures adherence to the property which we want to verify, will be specific to the concrete 
domain of the application. Hence in a general framework like the one proposed here, its description 
must be given as an input. A method to obtain the actual system distances, for some desired level of 
interaction, is then prescribed by the framework. 

In this paper we assume that this system distance input is given as a distance on traces: Given two 
sequences of executions, one needs only to define what it means for these sequences to be closely related 
to each other. We show that such a trace distance always gives rise to natural notions both of linear and 
of branching distance. 

To relate linear and branching distances, we introduce a general notion of simulation game with 
quantitative objectives. The idea of using games for linear and branching equivalences is not new 1251 



and has been used in a quantitative setting e.g. in fO'TTl, but here we explore this idea in its full generality. 

One interesting result which we can show in our general framework is that for all interesting trace 
distances, the corresponding linear and branching distance are topologically inequivalent. From an ap- 
plication point of view this means that corresponding linear and branching distances (essentially) always 
measure very different things and that results about one of them cannot generally be transferred to the 
other. This result - and indeed also its proof - is a generalization of the well-known fact that language 
inclusion does not imply simulation to a quantitative setting. 

We also show that for the common special case that the trace distance has a recursive characteri- 
zation, the associated branching distance can be obtained as a least fixed point to a similar recursive 
characterization. This is again a generalization of some standard facts about simulation, but shows that 
for a large class of branching distances, characterizations as least fixed points are available. 
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2 From Trace Distances to System Distances 

Our object of study in this work are general K-weighted transition systems (to be defined below), where 
K is some set of weights. For applications, K may be further specified and admit some extra structure, 
but below we just assume K to be some finite or infinite set. 

Definition 1. A trace is an infinite sequence (aA ._„ of elements in K. The set of all such traces is 
denoted K®. 

Note that we confine our study to infinite traces; this is mostly for convenience, to avoid issues with 
finite traces of different length. All our results are valid when also finite traces are allowed and the 
definitions changed accordingly. We write Oj for the jth. element in a trace a, and o^ for the trace 
obtained from a by deleting elements Oq up to CJy_i. 
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Definition 2. A K-weighted transition system (WTS) is a pair A = {S, T) of sets S, T with T CSxlKxS. 

We use the familiar notation s ^ s' to indicate that {s,x,s') € T. Note that S and T may indeed be 
infinite, also infinite branching. For simplicity's sake we shall follow the common assumption that all 
our WTS are non-blocking, i.e. that for any state s £ S there is a transition 5 ^- 5' in T. 

A path from sq G 5 in a WTS {S,T) is an infinite sequence [sj — > Sj+\) -q °^ transitions in T. 
The set of such is denoted Pa(5'()). We will in some places also need finite paths, i.e. finite sequences 
[sj -^ Sj+i) -Q of transitions; the set of finite paths from 5'o is denoted fPa(5'o). For a finite path n as 
above, we let len(;r) = n denote its length and last(;r) = s^^i its last state. We write Tlj = Sj for the 
(j + l)th state and tr(7i:)y for the (7 + l)th weight in a finite or infinite path. 

A path 71 = (^Sj -^ ^j+i) ^0 giv^s rise to a trace tr(7r) = (xy) .^^^ The set of (infinite) traces from 
So £ Sis denoted Tr{so) = { tr{n) | n G Pa(5'o)}. 

2.1 Interlude: Hemimetrics 

Before we proceed, we recall some of the notions regarding asymmetric metrics which we will be using. 
First, a hemimetric on a set X is a function (i : Z x X — )• [0, 00] which satisfies d{x,x) = for all x G X 
and the triangle inequality d{x,y) + d{y,z) > d{x,z) for all x,y,z G X. 

We will have reason to consider two different notions of equivalence of hemimetrics. Two hemimet- 
rics di, d2 on X are said to be Lipschitz equivalent if there are constants m,M G IR such that 

mdi{x,y) <d2{x,y) <Mdi{x,y) 

for all x,^ G X. Lipschitz equivalent hemimetrics are hence dependent on each other; intuitively, a 
property using one hemimetric can always be approximated using the other. 

Another, weaker, notion of equivalence of hemimetrics is the following: Two hemimetrics di, d2 on 
X are said to be topologically equivalent if the topologies on X generated by the open balls Bi{x\r) = 
{y £X\ di{x,y) < r}, for / = 1,2, x G X, and r > 0, coincide. Topological equivalence hence preserves 
topological notions such as convergence of sequences: If a sequence (xy) of points in X converges in one 
hemimetric, then it also converges in the other. 

It is a standard fact that Lipschitz equivalence implies topological equivalence. From an application 
point-of-view, topological equivalence is interesting for showing negative results; proving that two hemi- 
metrics are not topologically equivalent can be comparatively easy, and implies that intuitively, the two 
hemimetrics measure very different properties. 

2.2 Examples of Trace Distances 

The framework we are proposing in this article takes as starting point a trace distance defined on execu- 
tions of a weighted automaton, i.e. a hemimetric dj '■ K® x K® — > [0,°°]. In this section we introduce 
a number of different such trace distances, to show that the framework is applicable to a variety of 
interesting examples. 

Discrete trace distances. The discrete trace distance on K® is defined by (i7-(a, t) = if a = T and 
Jr (a, t) =00 otherwise. Hence only equality or inequality of traces is measured; we shall see below that 
this distance exactly recovers the usual Boolean framework of trace inclusion and simulation. 
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If K comes equipped with a preorder C C K x K indicating that a label ;c G K may be replaced by 
anyy G K withjc Qy, as e.g. in (26], then we may refine the above distance by instead letting dT{G,x) =0 
if Oj C Zj for all j and Jj (a, t) = oo otherwise. We will see later that using this trace distance, we exactly 
recover the extended simulation of 1261; note that something similar is done in ll23l . 



Hamming distance. If one defines a metric J on K by d{x,y) =Oif x = y and d{x,y) = 1 otherwise, 
then the sum T.jd{Oj,rj) for any pair of finite traces a, T of equal length is precisely the well-known 
Hamming distance [18|. For infinite traces, some technique can be used for providing finite values for 
infinite sums; two such techniques are to use limit average or discounting. We can hence define the 
limit-average Hamming distance by dT{o,T) = limmfj^oo^Y.jd{aj,rj), and for a fixed discounting 

factor < A < 1, the discounted Hamming distance by djio, x) = Y,j ^^d{aj, Ty). 

Note that this approach can easily be generalized to other (hemi)metrics d on K; indeed the discrete 
trace distances from above can be recovered using d{x,y) =OifxQy and d{x,y) = oo otherwise. 

Labeled weighted transition systems. A common example of weighted systems Il6l49l l27]l has K = 

r X R where £ is a discrete set of labels. Hence x = {x'',x^^) G K has x^ G £ as discrete component 
and x^ G E, as real weight. A useful trace distance for this type of systems is the point-wise distance, 
see ||2l|27'|, given by t/r(a,T) = supy {aj - tJ\ if aj = tj for all j and (ir(a, t) = oo otherwise. This 
measures the biggest individual difference between a and T. 

Another interesting trace distance in this setting is the accumulated distance |[27]| . where individual 
differences in weights are added up. Again one can use limit average or discounting for infinite sums; 
limit-average accumulating distance is defined by 



dT[(y,T)-- 

and discounted accumulating distance, for a fixed A < 1 , by 



hmM^TAoY-Tfl if af = rf for all 7 
oo otherwise 



, , . Jl/^Vr-'^ri if af = T/ for all ;• 
I oo otherwise 

This is indeed a generalization of the Hamming distance above, setting (i((x,H'),(y,v)) =|h' — v|ifx = j 
and fif((x,w), (y,v)) = oo otherwise. 

Also of interest is the maximum-lead distance from fT9l, where the individual weights are added up 
and one is concerned with the maximal difference between the accumulated weights. The definition is 

^^(^^.^^/^"P.llio^r-LLo^rl ifa; = TJforalli 
I oo otherwise 



2.3 Simulation Games 

In this central section we introduce the game which we will use to define both the linear and the branching 
distances. We shall use some standard terminology and constructions from game theory here; for a good 
introduction to the subject see e.g. llT3l . 
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Let A = {S,T) be a weighted transition system with s,t G S and dj '■ K'*' x K'*' -^ [0,°°] a trace 
distance. Using A as a game graph, the simulation game played on A from {s,t) is an infinite turn- 
based two-player game, where we denote the strategy space of Player / by 0, and the utility function of 
Player 1 by m : ©i x ©2 — > [0,oo]. As usual u determines the pay-off of Player 1; we will not use pay-offs 
for Player 2 here. 

The game moves along transitions in A while building a pair of paths extending from s and t, accord- 
ing to the strategies of the players. In the terminology of |,5jil4J we are playing Si partisan path-forming 
game. 

A configuration of the game is a pair of finite paths (tti , 712) G fPa(s) x fPa(f ) {i.e. the history) which 
are consecutively updated by the players as the game progresses. The players must play according to a 
strategy of the following types: 

• ©1 = rfPa(i)xtPa(r)^ {j^g gg{ Qf mappings from pairs of finite paths to transitions, with the additional 
requirement that for all di € ©1 and (711,712) € fPa(i') x fPa(?), 01(711,712) = (last(7ri),x,i'') for 
some ;c € K, 5' € 5. This is the set of Player- 1 strategies which observe the complete configuration. 

• Similarly, ©2 = rfPa(i)xfPa(r) ^j^j^ ^j^^ additional requirement that for all di G ©2 and (711,712) G 
fPa(s) x fPa(?), 62(711,71:2) = (last(7r2),3',f') for somej G K, t' G S. 

• ©1 = rtT'a(.v)^ j-jjg ggj pjT blind Player-1 strategies which cannot observe the moves of Player 2. 
(Blind Player-2 strategies can be defined similarly, but we will not need those here.) It is convenient 
to identify ©i with the subset of ©1 of all strategies di which satisfy 61(711,712) = 61(711,712) for 
all 711 G fPa{s), 712, 712 G fPa(0- 

• In the proof of Proposition |4] we will also need Player-2 strategies with additional memory. Such 
a strategy is a mapping fPa.{s) x fPa(f ) xM ^T xM, where M is a set used as memory. 

Given a game with configuration (711,712), a round is played, according to a strategy profile {i.e. a 
pair of strategies) (0i , 62) G ©1 x ©2, by first updating 7ri according to Q\ and then updating the resulting 
configuration according to 02- Hence we define 

Round(e,,e2) (^1 > ^2) = (?ri • ^i (?ri , 712), 712 • 02(?ri • ^i ijii , 712), 712)) 

where • denotes sequence concatenation. 

A strategy profile {61,62) G ©1 x ©2 inductively determines an infinite sequence ((^1 ,?r2))'"=o °^ 
configurations given by (715*, 71°) = (■^',0 and (71^,712) = Round^Q^Q^'j{7i-l^ ,712 ) for j > 1. The paths 
in this sequence satisfy 71- C n-^ , where C denotes prefix ordering, hence the limits 711(61,62) = 
limy^oo 71^ G Pa(5'), 712(61 , 62) = limy^oo 712 ^ Pa(f) exist (as infinite paths). We define the utility function 
u as 

M(0i,62)=^r(tr(7ri(0i,02)),tr(7r2(0i,02))) 

This determines the pay-off to Player 1 when the game is played according to strategies 61, 62. Note 
again that the utility function for Player 2 is left undefined; especially we make no claim as to the game 
being zero-sum. 

The value of game on A from {s,t) is defined to be the optimal Player-1 pay-off 

v{s,t) = sup inf u{6i,62) 

eiG©i 02^02 

Observe that the game is asymmetric; in general, v{s,t) ^ v{t,s). 
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A strategy di for Player 1 is said to be optimal if it realizes the supremum above, i.e. whenever 
infejeOj u{di , 62) = supg^gQ^ infe2ee2 "(^i i ^2)- The strategy is called e-optimal for some £ > provided 
that inf 92^02 m(0i , 62) > supg^gg^ infejg©^ "(^1 > ^2) — £■ Note that £-optimal strategies always exist for 
any £ > 0, whereas optimal strategies may not. 

We also recall that the game is said to be determined if the sup and inf above can be interchanged, 
i.e. iiv{s,t) = infe^ee, supej^Qj u{d\ , 02)- Intuitively, the game is determined if there also exist £-optimal 
Player-2 strategies for any £ > which realize the value of the game (up to e) independent of the strategy 
Player 1 might choose. 

The 1 -blind value of the game is defined to be 

v{s,t)= sup inf ^(61,62) 

eiGGi 02^02 

2.4 Example: Discrete Trace Distance 

It may be instructive to apply the above simulation game in the context of the discrete trace distance 
dT{o,l) = if a = T, dT{o,x) = °° otherwise, from Section l2!2l In this case, the game has value 
v{s,t) = if and only if, for every d\ G ©i there exist a 62 G ©2 which in each round / > of the game, 
in configuration {n[,7Z2)'' maps B2{n\,7Z2) = (last(7r2),^,f(+i) whenever B\{K\,n2) = (last(7r5),x,5,+i). 
Otherwise, v{s,t) = 00. 

Hence we have v{s,t) = if ? simulates s in the sense of f245, and v{s,t) = 00 otherwise. In other 
words, for discrete trace distance the game reduces to the standard simulation game of |25|. 

Likewise, the blind value v{s,t) = if and only if every d\ G ©i and corresponding path n\ has 
a match 62 G ©2 where configuration {^[^■kI^), of round / > facilitates d2{'^[,'^2) = (last(7r2))-^5^(+i) 
whenever Q\^{n[,n2) = (last(;rJ),A;,i';+i). Hence v{s,t) = if Tr(5) C Tr(f); we recover standard trace 
inclusion. 

2.5 Linear and Branching Distance 

We can now use the game introduced in Section 1231 to define linear and branching distance: 
Definition 3. Let A = {S, T) be a WTS and s,t eS. 

• The linear distance /rom s to t is the 1 -blind value di{s,t) = v{sj). 

• The branching distance /rom stot is the value dB{s,t) = v{s,t). 

We proceed to show that the distances so defined are hemimetrics on S, cf. the proof of Theorem 1 
in fS]. For linear distance, this also follows from Theorem |6] below, and we only include the proof for 
reasons of exposition. For branching distance, we have to assume in the proof below that the simulation 
game is determined; currently we do not know whether this assumption can be lifted. 
Proposition 4. Linear distance di is a hemimetric on S, and if the simulation game is determined, so is 
ds- 

Proof. Non-negativity of di and ds follow directly from the non-negativity of dj . To prove that di {s,s) = 
dB{s,s) =0 for all s G 5, given any strategy 61 G ©1 , we construct a Player-2 strategy 62 G ©2 that mimics 
61 and attains the game value of 0, as follows: 

fl .V ^^ /^l(^'^) if TT' = 71-01 (71,71) 

02(71 ,71 j = < 

I (last(7r),3',/) for some {last{7l), y,s') G T otherwise 
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Figure 1 : Construction of strategies in the proof of Proposition |4] 

It can be seen easily that the paths constructed by both players are the same, i.e. u{7i\ , 712) = dT{l, t) for 
some T G Pa(i'o). Therefore, ^(711 , 712) = as J^ is a hemimetric, whence di{s,s) = dsis^s) = 0. 

We are left with showing that d^ and ds obey the triangle inequality. For linear distance, let s\,S2,st,^ 
S and write 0['^ (0^^ ) for the set of (blind) Player-/: strategies in the simulation game computing d^ {sj ,Sj), 
for /, J G {1,2,3} and k € {1,2}. Let £ > 0. It might be beneficial to look at Figure [T] to see the "chase 

of strategies" we will be conducting. 

13 ~ 1 3 
Choose a blind Player-1 strategy 6^' G 0^' . Blind strategies correspond to choosing a path, so 

let TTi € Pa(i'i) be the path chosen by 0j' . This path in turn corresponds to a blind Player-1 strategy 

el'' G &[\ 

19 19 1 9 1 9 

Let 62' G ©2 ^^ ^ Player-2 strategy for which u{6^ ' , ©2' ) < dL{si,S2) + f . Write 712 € ^^{^2) for 

19 19 9'^ '^9'^ 

the path constructed by the strategy profile (0j' ,62' )> and let 0^' G ©j' be a blind Player-1 strategy 
which constructs 712- 

91 9*? 9191 

Let 62' G ©2 ensure u{d^ ' ,62' ) < dL{s2,s^) + |. Write 713 G Pa(53) for the path constructed by 

9191 11 11 

the strategy profile {B{ ,62' ). and let 62 G ©2 ^e a strategy which constructs 713. For the strategy 
profile (0j ' , ^2' ) in ^1,3, the paths constructed are Ki G Pa(5i) and 713 G Pa(i'3). Hence we have 



,1,3 



inf u{el',d2) <u{dl 



1,3 fll,3x 



= (3fr(7ri,7r3) 

< dr {tci, 712) + dT {712,713) 

=M(0/'^02'■')+«(e^^02'^) 

< dLisi,S2) + dL{s2,S3) + £ 



(1) 



il,3 



vl,3 



As 0j ' G ©j' was chosen arbitrarily, we have 



sup inf u{di,d2)<dL{si,S2)+dL{s2,S3)+e 



9iee|'e2ee'-^ 



and as also e was chosen arbitrarily, J^ (5 1,53) <dL{si,S2)+dL{s2,S3). 

For branching distance, we cannot construct the paths in a one-shot manner as above, as the tran- 
sitions chosen by Player 1 may depend on the history of the play. Let again £ > 0; assuming that the 

12 12 23 23 

simulation game is determined, we can choose Player-2 strategies Oj £ ®2 > ^2 ^ ®2 ^'^^ which 
sup Q ^^1,2 u{di , 62' ) <dB{si,S2) + ^ and supg gQ2.3M(0i,02' ) < ^3(^2,^3) + ^. Intuitively, we will use 
these strategies to allow Player 2 to find replying moves to Player-1 moves in the game computing 
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dsi^i,^!) by using the reply given by 62' to the reply given by ©2 • Hence we still follow the proof 
strategy depicted in Figure [T] but now for individual moves. 

The strategy 62' uses a finite path m = K2 G fPa(i'2) as memory and is defined by 

d^'' (TTi ,K^){K2) = 62'' {^2 ■ 02 ''(^1 ' ^2) , nj) 

with memory update m ( TTi , 713 ) ( 712 ) = ^^2 • ^2 ( ^1 ) ^2 ) ■ The initial memory for 62' is set to be the empty 
path, hence as the game progresses, a path 712 € Pa(i'2) is constructed. 

Now choose some 0j ' € ©j' , and let 7i\ G Pa(i'i) and 713 G Pa(53) be the paths constructed by the 
strategy profile (0j' ,62' )■ If 712 € Pa{s2) is the corresponding memory path, then the pair (711,712) is 
constructed by the strategy profile (0j ' ,62' ) and the pair (712, 713) by the profile [62' ,62 )• Hence we 
can use the exact same reasoning as in ([B to conclude that 

inf m(0i' ,62) <dB{si,S2)+dBis2,ST,) + E 
and hence (5fe(si, 53) <dB{si,S2)+dB{s2,S3). O 

2.6 Properties 

The following general result confirms that, regardless of the trace distance chosen, the linear distance 
is always bounded above by the branching distance. In the context of the discrete trace distance from 
Section l2!2l this specializes to the well-known fact that simulation implies language inclusion. 

Theorem 5. For any s,t £ S, we have dL{s,t) < dB{s,t). 
Proof. Any Player- 1 strategy in ©i is also in ©i, hence 

sup inf u{6i,62)< sup inf u{0[,02) D 

01 £01 02602 61 £01 92602 

The game definition of linear distance yields the following explicit formula. Note the resemblance 
of this to the well-known Hausdorff construction for lifting a metric on a set to its set of subsets. 

Theorem 6. For all s,t £ S we have 

dtisjt) = sup inf dT{o,T) 

(TGTr(i) TeTr(r) 

Proof. The definition of v{s, t) immediately entails the fact that for any 7ri € Pa(5') there exists 712 G Pa(0 
such that (i7-(tr(7ri),tr(7r2)) < v{s,t). It remains to show that v{s,t) < sup^gTj.(^Ainf^gTr(r)^T(<7)'^)- By 
blindness, any 0i G ©i produces a unique path Tii G Pa(5) independent of the opponent strategy 02 G ©2- 
Hence we need only consider strategies 82 which define a single path 712 from t, and the result foUows.D 

We finish this section by exposing two properties regarding equivalence of the introduced hemimet- 
rics. Transferring (in)equivalence of distances from one setting to another is an important subject, and 
we hope to show other results of the below kind, especially relating trace distance to branching distance, 
in future work. 

Proposition 7 (c/. f?, Thm. 3.87]). If trace distances d\ and dj are Lipschitz equivalent, then the cor- 
responding linear distances d^ and dj^ are topologically equivalent. 
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0'0 = To 





Ol 



ri 



Figure 2: Weighted transition system for the proof of Proposition |9] 

Proof. This follows immediately from Theorem [6] and Theorem 3.87 in |4|. Note that the theorem in lU 
actually is stronger; it is enough to assume dj and dj to be uniformly equivalent. D 

The next theorem shows that if a trace distance can be used for measuring trace differences beyond 
the first symbol (which will be the case except for some especially trivial trace distances), then the cor- 
responding linear and branching distances are topologically inequivalent. The proof is an easy adaption 
of the standard argument for the fact that language inclusion does not imply simulation. 

Definition 8. A trace distance dj : K® x K"" is said to be one-step indiscriminate if Oq = To implies 
dj{o, t) = 0/or all a, T G K'". 

Proposition 9. If dj is not one-step indiscriminate, then there exists a weighted transition system A on 
which the corresponding distances di and dg are topologically inequivalent. 

Proof Let a, T e K'" such that Oq = To, djio, t) > 0, and (ir(T, a) > 0. A is depicted in Figure|2] 

WehaveTr(5) =Tr(f), hence ^^(5,?) =0. On the other hand, ^^(i',?) =min (<ir(a,T),(i7-(T,a)) >0. 
As two equivalent hemimetrics have value at the same set of pairs of points, this finishes the proof. D 

Also note that if a and T are cyclic, the construction can be adapted to yield & finite WTS A. 

3 Recursively Defined Distances 

The game definition of branching distance in Definition |3] gives a useful framework, but it is not very 
operational. In this section we show that if the given trace distance has a recursive characterization, 
then the corresponding branching distance can be obtained as the least fixed point of a similar recursive 
formula. 

We give the fixed-point theorem first and show in Section 13.11 below that the theorem covers all 
examples of distances introduced earlier. 

Theorem 10. Let Lbe a complete lattice and f : K® x K® ^> L, g : L ^ [0, 00], _F : K x K x L — ^ L such 
that dj = go f, g is monotone, F{x,y,-) :L^ Lis monotone for all x,)' G K, and 



f{a,T) = F{ao,ToJ{a\r')) 



(2) 
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for all a,T£ K®. Define I : L^^^ -^ L^""^ by 

I{h){s,t) = sup inf F{x,y,h{s',t')) 

Then I has a least fixed point h* : S x S —^ L, and dg = go h*. 

Let us give some intuition about the theorem before we prove it. Note first the composition dj = 
go f, where / maps pairs of traces to the lattice L which will act as memory in the applications below. 
Equation ^ then expresses that F acts as a distance iterator function which, within the lattice domain, 
computes the trace distance by looking at the first elements in the traces and then iterating over the rest 
of the trace. Under the premises of the theorem then, branching distance is the projection by g of the 
least fixed of a similar recursive function involving F. 

Proof. It is not difficult to show that / indeed has a least fixed point: The lattice L^^^ with partial order 
defined point-wise by h\ < /i2 iff h\ {s,t) < h2{s,t) for all s,t ^ S is complete, and / is monotone because 
of the monotonicity condition on F, hence Tarski's Fixed-point Theorem can be applied. 

To show that d^ = g o h* , we pull back dg along g: With the notation for the simulation game from 

Section [231 define 

fBis,t)= sup inf f{tr{Ki{ei,d2))MMdi,d2))) 
e,e@, 02^02 

We have fi?B = g o/b by monotonicity of g, so it will suffice to show that fs = h*. 
Let us first prove that fs is a fixed point for /: Let s,t £ S, then 

/(/b)(5,0 = sup inf F{x,y,fB{s',t')) 

s-^s'tA-t' 

= sup inf F(x,3;, sup inf f{tr{n,{d[,d^))MMd[,02)))) 
= sup inf sup^ inf^F(x,3;,/(tr(7ri(0i',0^)),tr(7r2(ei',e2)))) 

(the last step by the monotonicity assumption on F; note that in the second sup-inf pair, strategies from 
s' and t' are considered). By the recursion formula Q for F, we end up with 

7(/b)(^,0 = sup inf sup M f{x-tr{7ii{d[,d^)),ytr{n2id[,d^))) 

Now because of independence of choices, we can rewrite this to 

/(/b)(s,0 = sup sup inf inf /(x-tr(7ri(0i',0^)),3;-tr(7r2(ei',e2))) 

and collapsing the sup-sup and inf-inf into one sup and inf, respectively, conclude /(/s) = /g. 

To show that fg is the least fixed point for /, let /j : 5 x 5 — )• L such that l(h) = h; we want to prove 
/s < h. Note first that for all s,t £S and all s A s', there i& t ^ t' such that F{x,y,h{s' ,t')) < I{h){s,t). 
Now fix s,t G S and let di G ©i; we will be done once we can construct a Player-2 strategy 02 G ©2 for 

which/(tr(7ri(0i,e2)),tr(7r2(0i,02)))</2(^,O- 

We have to define 02 for configurations {7i[,7i2) € fPa.{s) x fPa(?) in which 7i[ = Tii ■ {sj,x,Sj^i) and 

len(;ri) = len(7r2)- Write last(7r2) = tj; by the note above, we can choose a transition tj — > tj+i for which 
F{x,y,h{s',t')) < I{h){s,t), so we let d2{7l[,n2) = {tj,y,tj^Y). The so-defined strategy has 

/(tr(;ri(0i,02)),tr(7r2(0i,02))) < sup inf F{x,y,h{^\t')) =h{s,t) D 

sAs'tA-t' 
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3.1 Applications 

We reconsider here the example trace distances from Section 12.21 and exhibit the corresponding linear 
and branching distances. 



Discrete trace distances. For the discrete trace distance on K® given by dT{o,x) = if a = T and 
driOjt) = oo otherwise, we saw already in Section 1241 that we recover ordinary trace inclusion and 
simulation. For linear distance, we can also use Theorem[6]to show that di{s,t) = if Tr(5') C Tr(?) and 
dL{s,t) = oo Otherwise. 

For the branching distance, we can now also apply Theorem [TOl with L = [0,oo], ^ the identity map- 
ping, and F{x,y,z) = z if x = 3^, F{x,y,z) = °° otherwise. Then the branching distance is the least fixed 
point of the equations dsis^t) = sup _>^ , inf _«, ,dB{s' ,t'), hence dB{s,t) =Oiit simulates s in the stan- 
dard sense [24], and dB{s,t) = 00 otherwise. 

For the refined discrete trace distance dT{o,x) = ii Gj Q Tj for all j, dT{o,x) = °° otherwise, 
we analogously get di{s,t) = if all a G Tr(i') can be refined by a T G Tr(f) {i.e. Oj Q Xj for all j) and 
dL{s,t) = 00 otherwise. Also, dB{s,t) = if there is a relation /? C 5 x 5 for which {s,t) G /? and whenever 
{s',t') G R and s' — > s", then also t' — > t" with x Qy and {s" ,t") G R (the extended simulation of 1,26 J ), 
and dB{s,t) = 0° otherwise. 

Hamming distance. For Hamming distance induced by the metric d{x,y) =0 if x = y and d{x,y) = 
1 otherwise on K, linear distance is given by di{s,t) <k if and only if any trace a G Tr(i') can be 
matched by a trace T G Tr(f) with Hamming distance at most k, both for the limit-average and the 
discounting interpretation. The branching distance associated with the discounting version is precisely 
the (discounted) correctness distance of [8|: dB{s,t) measures "how often [the system starting in ^2] can 
be forced to cheat", i.e. to take a transition different from the one the system starting in ^i takes. 



Labeled weighted transition systems. For the trace distances on labeled weighted transition systems, 
let us for simplicity assume that |r[ = 1, hence K = R. For the point-wise trace distance dT{o,z) = 
sup ■ I ay — Tjl we can derive a recursive formula for the corresponding branching distance by applying 
Theorem [TOl with L = [0,°°], g the identity mapping, and F{x,y,z) = max ([x — 3^1,2). Then ds is the least 
fixed point to the equations 

dB{s,t)= sup inf ma.x(^\x — y\,dB{s',t')^ 

For discounted accumulated trace distance drio, t) = T^i^^Oj — Ty[, we can similarly let F{x,y,z) = 
\x — y\+ Xz, then the corresponding branching distance is the least fixed point to the equations 

dB{s,t)= sup inf \x — y\+XdB{s',t') 

Note that these two branching distances are exactly the ones the authors define in |!27l|. 

For the maximum-lead distance driOjT) = sup|^/^Qa, — L/=o'^'i' ^^ n&e.d to do more work. In- 
tuitively, a recursive formulation needs to keep track of the accumulated delay, hence needs (infinite) 
memory. This can be accomplished by letting L = [0,oo][^°°H; the set of functions from leads to dis- 
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tances. We can then define 

j J 

/(a,T)(5)=max(|5|,sup|5 + £a;-£Ty|) 

j=0 i=0 i=0 

and g{h) =h{0). Now with F{x,y,h){5) = max {\5 + x — y\,h{d + x — y)) , we indeed have that /(a, t) = 
F((To,'Z:o,/(cj\t^)), hence we can apply Theorem [TOl to conclude that dB{s,t) = h*{s,t){0), where h* is 
the least fixed point to the equations 

h{s,t){d) = sup inf max [\5 + X — y\,h{s',t'){5 +x — y)) 
This is precisely the formulation of branching maximum-lead distance given in |fT9l . 

4 Conclusion and Future Work 

We have shown that simulation games with quantitative objectives provide a general framework for 
studying linear and branching distances for quantitative systems. Specifically, that our framework covers 
and unifies a number of previously distinct approaches, and that certain common special cases lead to 
useful recursive characterizations of branching distance. 

Already we have seen that one very general property, topological inequivalence of linear and branch- 
ing distance, follows almost immediately from the game characterization. Also this general approach 
permits the conclusion that independent of the trace distance, the branching distance provides an upper 
bound on the linear distance, a property which is useful for applications such as analysis of real-time 
systems, where linear distances are known to be uncomputable ETl . 

It seems likely that by permitting a broader range of strategies, we may encompass more advanced 
levels of system interaction and observations, and hence capture quantitative extensions of other well- 
known system relations such as 2-nested simulation |[T][I21 or bisimulation [24 J. Thus, we expect our 
framework to be of great use for reasoning about, and applying quantitative verification. 

The game perspective on linear and branching distances also suggests that several interesting results 
and properties of games with quantitative objectives are transferable to our setting. As an example, 
one may consider computability and complexity results: For a concrete setting such as finite weighted 
labeled automata, discounted or limit average accumulating distances can be computed using discounted 
and mean-payoff games, respectively. Hence the complexity of computing these branching distances is in 
N P n coN P. Similarly, results concerning strategy iteration or value iteration for games with quantitative 
objectives may be transferred to the distance setting. 
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